New Advanced Linux VoidLink Malware Targets Cloud and container Environments

Cybersecurity researchers have disclosed VoidLink, a previously undocumented Linux malware framework aimed at long-term, stealthy access to cloud environments. First discovered in December 2025, VoidLink is described by Check Point Research as a feature-rich, cloud-native toolkit with loaders, implants, rootkits, and a modular plugin system that can be augmented over time.

It is written in Zig and is capable of detecting major cloud platforms such as AWS, Google Cloud, Microsoft Azure, Alibaba, and Tencent, and can adapt its behaviour if it finds it is running inside a Docker container or a Kubernetes pod. The framework ships with more than 30 default plug-ins and supports 37 plugins overall, enabling capabilities from anti-forensics and recon to lateral movement and persistence, including an SSH-based worm for lateral spread.

According to Check Point Research, VoidLink includes a core orchestrator for C2 communications and a range of anti-analysis features, plus a Chinese web-based dashboard for remote control; the researchers also note a shift towards Linux threats in cloud ecosystems and describe the operators as China-affiliated claims.